Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Paul Vixie thinks more people should be running their own DNS servers

businessinsider.com

Post reply on HN
Print view View original

101–110 of 155 posts

Re: Paul Vixie thinks more people should be running their own DNS servers

#101

Post by zAy0LfpBZLC8mAC »

hazeii wrote: post #97
rmdoss wrote: post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

Single data point, but I've been running a home DNS server (bind) for many years; it's set to be authoritative for the .local domain and caching for everything else (except for major tracking and advertising sites, which it blackholes). For hits that are in the cache (the usual case) it's obviously faster than going out to the 'net,. The black-holing combined with ad-blockers mean browsing is a lot faster and conside…

> One other catch is that your ISP might block you for not using their DNS; BT (UK ISP) did this

Erm ... what? How does that work? If they don't see DNS requests from you at their resolver for a week, they disable your connection?!

Re: Paul Vixie thinks more people should be running their own DNS servers

#102

Post by scrollaway »

johnklos wrote: post #45
rmdoss wrote: post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

Performance for Google or Cloudflare isn't going to be better. Where do you get that idea? Do you think all DNS simply lives in their caches? "your ISPs can't see what you are doing". If they're analyzing traffic, they can, and if they're doing that, they can see to whom I'm connecting, anyway. But you say nothing about why we should trust Google or Cloudflare. I trust my ISP to be big and dumb. I trust Goole and Clo…

Google has spiders that crawl the entire web. Cloudflare RUNS DNS for a bunch of the web.

Yes, a lot of DNS does live in their cache, quite literally.

Re: Paul Vixie thinks more people should be running their own DNS servers

#103

Post by znpy »

rmdoss wrote: post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

Regarding mailservers, it’s feasible to run one at home.

But many people rely on spamlists, ie lists of ips known to relay spam. The proble with this is twofold:

1. Some people just took the authority to decide who sends spam and who does not. If you get on one of those lists, usually you have to get in touch and pay to get out.

2. Such people usually include residential ip subnets by default, for no technical reason whatsoever.

So in the end my mailserver at home has been in a spamlist for years, even though i never relayed spam and was very careful to configure outbound relay authentication/authorisation, spf, dkim etc.

Re: Paul Vixie thinks more people should be running their own DNS servers

#104

Post by hazeii »

zAy0LfpBZLC8mAC wrote: post #101
hazeii wrote: post #97

Earlier quoted context omitted.

Single data point, but I've been running a home DNS server (bind) for many years; it's set to be authoritative for the .local domain and caching for everything else (except for major tracking and advertising sites, which it blackholes). For hits that are in the cache (the usual case) it's obviously faster than going out to the 'net,. The black-holing combined with ad-blockers mean browsing is a lot faster and conside…

> One other catch is that your ISP might block you for not using their DNS; BT (UK ISP) did this Erm ... what? How does that work? If they don't see DNS requests from you at their resolver for a week, they disable your connection?!

What happened is going online resulted in everything being redirected to a BT page saying you're not using our DNS and to change settings so you do. Some googling revealed a few people who'd had the same issue and found the (obscure) page that allowed you to undo the block.

I assume they detected it simply by seeing DNS queries going to non-BT servers. Note this was a few years ago when it was pretty common for PC malware to hijack DNS requests, so could be it's changed in the meantime.

N.B. I also recall BT redirecting requests for non-existent domains to some partner of theirs, I assume experimentally as I haven't seen or heard of that for a while.

Re: Paul Vixie thinks more people should be running their own DNS servers

#105

Post by leowoo91 »

vkaku wrote: post #87

I agree with Paul Vixie. The internet, IMO, is not a playground for large corporations. What originally made the Internet amazing was the participatory nature of it. As it started 'standardizing' or 'accruing', autonomy was lost in the pursuit of efficiency. Today, 2-3 corporations are just trying to own the internet, and this needs to stop. I favour a participation in the Internet than what it is today. Okay, so how…

Congratulations, you've just spend your time, and your mobility.

Re: Paul Vixie thinks more people should be running their own DNS servers

#106

Post by vlkramer »

rmdoss wrote: post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

With 8.8.8.8 Google sees all requests, which is probably the reason for its existence. How can an ISP not see what you are doing anyway? traceroute $addr obviously always includes ISP servers.

Unless you use a VPN, but that is a different story.

Re: Paul Vixie thinks more people should be running their own DNS servers

#107

Post by zAy0LfpBZLC8mAC »

icedchai wrote: post #48
johnklos wrote: post #45

Earlier quoted context omitted.

Performance for Google or Cloudflare isn't going to be better. Where do you get that idea? Do you think all DNS simply lives in their caches? "your ISPs can't see what you are doing". If they're analyzing traffic, they can, and if they're doing that, they can see to whom I'm connecting, anyway. But you say nothing about why we should trust Google or Cloudflare. I trust my ISP to be big and dumb. I trust Goole and Clo…

Yes. Performance of Google / Cloudflare DNS will be better simply because so many other people are using them: any common DNS query result will probably already be cached... FYI I run my own DNS server anyway.

But what is common for you will usually be cached already in your own server as well, so most requests will still be cache hits--and all those hits avoid the ~ 20 to 100 ms round trip to the internet.

Take news.ycombinator.com, for example: The A record has a TTL of 300 seconds. So, after the first visit, which probably will take a bit longer than asking Google/CF, for every request in the next five minutes, you will have a reduced lookup latency.

Then, after five minutes, the next lookup will go out to the authoritative server. But mind you that the NS records for ycombinator.com have a TTL of two days, so those are still cached, and the refresh is indeed a single request to the authoritative server--which more often than not takes about as long as a cache hit from the recursive Google/CF resolvers (it's also one round trip to the internet ...).

And then, there is stuff like BIND's prefetch mechanism which will start the refresh of an expiring record when it sees a query for that record shortly before its expiry: That query is answered immediately from the cache, and a refresh is started in the background, so that the refreshed record should arrive in the cache before the old version expires ... thus completely eliminating the lookup latency for often-used records. Though you might need to tune it to trigger earlier for your personal use than in the default configuration ...

Re: Paul Vixie thinks more people should be running their own DNS servers

#108

Post by [deleted] »

scrollaway wrote: post #102
johnklos wrote: post #45

Earlier quoted context omitted.

Performance for Google or Cloudflare isn't going to be better. Where do you get that idea? Do you think all DNS simply lives in their caches? "your ISPs can't see what you are doing". If they're analyzing traffic, they can, and if they're doing that, they can see to whom I'm connecting, anyway. But you say nothing about why we should trust Google or Cloudflare. I trust my ISP to be big and dumb. I trust Goole and Clo…

Google has spiders that crawl the entire web. Cloudflare RUNS DNS for a bunch of the web. Yes, a lot of DNS does live in their cache, quite literally.

[deleted]

Re: Paul Vixie thinks more people should be running their own DNS servers

#109

Post by zAy0LfpBZLC8mAC »

znpy wrote: post #103
rmdoss wrote: post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

Regarding mailservers, it’s feasible to run one at home. But many people rely on spamlists, ie lists of ips known to relay spam. The proble with this is twofold: 1. Some people just took the authority to decide who sends spam and who does not. If you get on one of those lists, usually you have to get in touch and pay to get out. 2. Such people usually include residential ip subnets by default, for no technical reason…

> 2. Such people usually include residential ip subnets by default, for no technical reason whatsoever.

Are you talking about residential or about dynamic? Because there kinda is a reason for this for dynamic addresses (PC malware sending spam, and the impossibility to list the particular affected PC because it's constantly changing addreses, so you only can block all the addresses those PCs could be using).

If you do have static addresses, whether residential or not, those should not be listed in dialup block lists.

If your home internet connection has dynamic addresses, you still can run your mail server at home by renting some tiny VPS and tunneling its addresses to your home server ...

Re: Paul Vixie thinks more people should be running their own DNS servers

#110

Post by znpy »

zAy0LfpBZLC8mAC wrote: post #109
znpy wrote: post #103

Earlier quoted context omitted.

Regarding mailservers, it’s feasible to run one at home. But many people rely on spamlists, ie lists of ips known to relay spam. The proble with this is twofold: 1. Some people just took the authority to decide who sends spam and who does not. If you get on one of those lists, usually you have to get in touch and pay to get out. 2. Such people usually include residential ip subnets by default, for no technical reason…

> 2. Such people usually include residential ip subnets by default, for no technical reason whatsoever. Are you talking about residential or about dynamic? Because there kinda is a reason for this for dynamic addresses (PC malware sending spam, and the impossibility to list the particular affected PC because it's constantly changing addreses, so you only can block all the addresses those PCs could be using). If you d…

> If you do have static addresses, whether residential or not, those should not be listed in dialup block lists.

Indeed my residential internet connection has a static address but it still gets flagged for spam because it’s inside a residential subnet.

Post reply on HN